The Singapore Protocol: Incoherent Eavesdropping Attacks 
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We thoroughly analyse the novel quantum key distribution protocol introduced recently in 
quant-ph/04 12075 which is based on minimal qubit tomography. We examine the efficiency of 
the protocol for a whole range of noise parameters and present a general analysis of incoherent 
eavesdropping attacks with arbitrarily many steps in the iterative key generation process. The com- 
parison with the tomographic 6-state protocol shows that our protocol has a higher efficiency (up 
to 20%) and ensures the security of the established key even for noise parameters far beyond the 
6-state protocol's noise threshold. 
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A. Introduction 

With the growing interest in quantum information the- 
ory, quantum cryptography has become a key research 
area. One way of ensuring secure communication is to 
establish a secret key between the two communication 
partners, Alice and Bob, with which they can later encode 
and decode secret messages. The distribution of the key 
can be done using quantum mechanical systems where 
the laws of physics guarantee the security, in marked 
contrast to classical schemes which rely on the complex- 
ity of mathematical problems. Quantum key distribu- 
tion could thus replace conventional public key cryptosys- 
tems, which can be broken in polynomial time by quan- 
tum algorithms as soon as suitable quantum computers 
are available. 

Most quantum key distribution schemes discussed at 
the current stage of research are based on the BB84 Q 
or the E91 Q protocol. These schemes operate in only a 
subspacc of the whole qubit state space, and so they al- 
low the eavesdropper, Eve, unnecessary freedom to make 
use of the undetected portion of the Hilbert space. This 
power is denied to her in fully tomographic key distribu- 
tion protocols, such as those of Ref. [3j, and in particular 
by the "minimal qubit tomography protocol" of Ref. Q| 
that has become known colloquially as the Singapore pro- 
tocol. It relies heavily on the minimal qubit tomography 
(MQT) discussed in Ref. 

In Ref. it was shown that the maximum theoretical 
efficiency of a quantum key distribution protocol using 
the MQT measurement is maximally log2 | = 0.415; this 
is less than the efficiencies of the non-tomographic BB84 
and E91 protocol which are \ and |, respectively. How- 
ever, the difference between the mutual information be- 
tween Alice and Bob (A&B) and the mutual information 
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between Eve and either Alice or Bob (CK-yield) promises 
to be higher than in the non-tomographic protocols |(|. 
Moreover, the MQT measurement has the potential for 
a significantly higher key yield than the comparable to- 
mographic 6-state protocol introduced in Ref. |9j and dis- 
cussed in Refs. ylEl, which has an efficiency of only i. 

Using the MQT measurement, one possible way to gen- 
erate a secret key from the correlated measurement out- 
comes was proposed in Ref. Q. The resulting quantum 
key distribution protocol recovers 0.4 key-bits per qubit 
pair, or 96.4% of the potential efficiency in the noise-free 
case. It is the objective of the present paper to give a 
detailed account of how the analysis is carried out that 
yields the thresholds stated in Ref. £| . A quantum key- 
distribution scheme that uses POVMs with tetrahedron 
structure is also investigated by Rcncs in Ref. [TlJ |. This 
protocol differs from the Singapore protocol by a less effi- 
cient key generation procedure that does not fully exploit 
the potential of the MQT measurement. 

In Scc.^]we give a brief overview of the MQT measure- 
ment and review the key generation in Sec -El I n Sec. I Dl 
we will discuss the constraints on Eve's eavesdropping 
imposed by the tomographic nature of the MQT mea- 
surement. We then investigate, in Sec.^J the incoher- 
ent attacks available to Eve when she exploits the classi- 
cal information transmitted between the communication 
partners during the key generation. Finally, in Sec. ID we 
examine the security of the protocol against such attacks 
and obtain the noise threshold stated in Ref. . 



B. Minimal qubit tomography 

We suppose Alice and Bob want to establish a secret 
key and they use a provider that distributes entangled 
qubit pairs for private communication. As advertised, 
each will receive one qubit of the pair. Since real commu- 
nication channels do not usually preserve the signal per- 
fectly, Alice and Bob have to deal with the fact that they 
will receive a distorted state. Let Alice and Bob agree to 
accept only a mixed state pa&b consisting of the ideal, 
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perfectly anti-correlated singlet \s)(s\ = \ (1 — a a • <?s) , 
and white, unbiased noise, weighted with a noise param- 
eter e. The two-qubit state that A&B will share is thus 

PAbB(e) = (l- e )| s )( s | + il, (1) 

where e ranges from e = (no noise) to e = 1 (nothing 
but noise). In practical situations, the class of acceptable 
sources should in fact be chosen in accordance with the 
experimental setup which produces the singlet and the 
properties of the transmission line used (fibre, air, ...). 
But for the sake of simplicity, we impose the above stan- 
dard criterion which was also used in the tomographic 
protocols of Ref. . 

The tomographically complete 6-st ate p rotocol was an- 
alyzed for the above scenario in Ref. |12| ■ In this proto- 
col, Alice and Bob each performs a measurement of a 
randomly chosen Pauli operator, a x ,<j y or er 2 , resulting 
in six outcome probabilities. However, this is not a min- 
imal tomography since only four outcome probabilities 
arc needed to specify the state of a qubit completely. 
The optimal qubit tomography POVM with the mini- 
mum number of four elements is of tetrahedron geometry 
as shown in Ref. [j| ; that is the POVM operators can be 
written in the form 

Pk = \{l+t k -ff) for k =1,2, 3, 4, (2) 

where the vectors t k point to the corners of a tetrahedron 
inscribed in the Bloch sphere; see Fig. 1 in Ref. [|| for an 
illustration. The four vectors are linearly dependent, 

4 

E^ = ' ( 3 ) 

k=i 

with the scalar product 

t k -t l = p kl -^ for k,l= 1,2,3,4, (4) 
and fulfill the dyadic completeness relation 

fe=l 

Let Alice and Bob each measure the tetrahedron 
POVM of Eq. J5J) on many copies of a two-qubit state 
p. The resulting joint probabilities of the measurement 
are then given by pki — tr [p P k Qi] , with P k denoting Al- 
ice's POVM elements and Qi Bob's, chosen so that their 
tetrahedrons are perfectly aligned (if they chose a non- 
zero angle between their tetrahedrons they would lose 
the perfect anti-correlations introduced by the singlet). 
To verify that they indeed received the state pa&b of 
Eq. 0J, Alice and Bob sacrifice a fraction of their data 
and announce them publicly to determine the joint prob- 
abilities pki of Alice measuring k and Bob I. They check 



their results for statistical independence and are able to 
reconstruct the original state by 

4 

P= £ (6P fc - 1) pm {6Qi - 1). (6) 

k,l=l 

Naturally, after a finite number of measurements, Al- 
ice and Bob cannot infer the values of the p k i exactly, 
but they can estimate them rather reliably. A discussion 
of the quality of such estimates was given in Ref. [j| for 
the single qubit case where it was also shown that the 
measurement of a randomly chosen qubit state with the 
tetrahedron POVM will on average lead to the best (op- 
timal) estimate of the state's Pauli vector. Finally A&B 
compare whether the predicted state of Eq. © is consis- 
tent with Eq. JQ). They will only use the provider if this 
is the case. 

Given the shared state is pA&e(e) for some e, their 
joint probabilities p k i will be 

Pki = ^0--Ski) + ^S kl for fc,Z = 1,2,3,4, (7) 
48 16 

and the accessible information that A&B can establish 
between each other is given by 

I1Tb(c) = (l - J) fog 2 ^ + \ log 2 e, (8) 

where we used the definition of the classical mutual in- 
formation for a probability distribution {pki\k.i 

I = Y] Pki log 2 =^ -^U • (9) 

^ Efe' Pk'i Li' p^' 

Note that in the noise-free case the accessible infor- 
mation, Ia^ s (0) = 0.415, is substantially higher (by 
24.5%) than the corresponding value of | for the tomo- 
graphically complete 6-state protocol. 

C. The Singapore protocol 

From now on, we will refer to the possible measure- 
ment outcomes as A, B, C, D for k = 1,2,3,4, respec- 
tively, symbolizing a click in the fc-th POVM detector. 
To generate a key from their correlated sequences, Al- 
ice and Bob have to communicate classically. We use 
the two-way key generation scheme proposed in Ref. 
which leads to a mutual information of Ia&zb(0) = 0.4, 
sufficiently close to the maximally accessible information 
of /^^ s (0) = 0.415. The scheme has a simple structure 
and can be easily implemented on a computer. We give 
a brief description of the key generation scheme followed 
by a more detailed analysis considering the presence of 
noise which will be relevant for the eavesdropping dis- 
cussion. We refer the reader to the original paper [4| for 
more details on the key generation scheme. 

Let us first consider the noise-free case (e = 0). Alice 
publicly announces two randomly chosen positions of her 
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TABLE I: Bob's two letters given that Alice announced two 
positions where she got the outcome A. 



sequence for which she has the same letter. With proba- 
bility |, Bob has different letters at these positions. He 
then groups the possible outcomes A, B, C, D in two 
groups, one containing the two letters he received and 
one with the remaining two letters. He randomly assigns 
the values and 1 to the two groups and announces these 
groupings. Bob does not reveal which group his letters 
belong to, but since A&B's measurement outcomes are 
perfectly anti-correlated, they can both write down the 
value of the group which contains Alice's letter and thus 
generate a key-bit. With probability i Bob has the same 
letter in the two positions Alice announced. In this case, 
he states this fact and A&B each write their correspond- 
ing letter in a new sequence. The above procedure is re- 
peated iteratively with the new sequences thus generated. 

In the presence of noise, the key sequence generated 
with the above scheme will contain errors with a rate 
dependent on e. For the original letter sequence (first 
iteration) , the probability of Alice and Bob receiving the 
same letter is then non-zero, see Eq. 0, 



Ps (e) 



(10) 



and Bob receives one of the other three letters with prob- 
ability 



Pd (e) 



12 



(11) 



With a priori probability j Alice announces the positions 
of two occurrences of the letter A. Then, Bob's corre- 
sponding two letters occur with the probabilities given in 
Table [U where M.P. denotes the marginal probabilities. 
The conversion into one key-bit will occur when Bob's 
letters are unequal, i.e. in all off-diagonal cases. Simi- 
larly, we can construct the probability tables for Alice's 
other choices of letters. Let us denote the probability of 
successfully generating one key-bit from one letter pair 
by ftucc ■ For the first iteration it is then 



Psucc ( e ) = ®Pd (Ps + Pd) = 



(4-e) (2 + e) 
12 



(12) 



wrong is given by 



(i) 

-FCIT 



(e) 



GpsPd 

I'succ 



Ps 



3e 



Ps +Pd 



2e' 



(13) 



accounting for the equally likely cases that Bob writes 
and Alice 1 and vice versa. The mutual information of 
the key itself is thus less than unity and depends on p, 
which is nonzero for nonzero e, 



(i) 

err j 



'key 



= 1+pW log 2 p« 



(14) 
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^en- 



Let us regard the mutual information as a cryptographic 
resource that Alice and Bob can use later to extract a per- 
fectly correlated key. We are therefore interested in the 
expectation value of the mutual information which A&B 
share per qubit pair. This expectation value is the prod- 
uct of the mutual information of the generated key-bit 
and the probability that this key-bit was actually gener- 
ated (psucc), divided by the number of qubit pairs needed 
(2 in the first iteration) to obtain the key-bit. 



r(l) 
A&zB 
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(4-e 
48 



key 



(15) 



(4 - e) log 2 



3e log 2 



3e 



To deduce similar results for further iterations we first 
study the properties of the recycled sequences. The sec- 
ond iteration can again be characterized by two probabil- 
ities p' s and p' d defined with analogous meanings as p s and 
Pd for the original sequence. The probability p' s is given 
by the probability of Bob receiving the same letter as 
Alice in the original sequence twice (p s 2 ) , divided by the 
total probability of keeping letters in the first iteration, 

i.e. failure in generating a key-bit, ^1 — pi 



o (1) 

^succ 



' 4-e \ 2 ' 
> 12 I 



(16) 



Similarly, p' d is given by 



P'd 



12 



I-P's 



Upon defining e' in accordance with p' s 



(17) 



and p' d 



, we can carry the analysis for the first iteration over 
to the next iteration by replacing e by e'. The relation 
between e' and e is most compactly stated in the form 



3e 



(18) 



However, these successfully generated key-bits will con- 
tain errors. The probability that a generated key-bit is 



showing that the noise reduces quadratically with each 
iteration step. All further iterations can thus be analyzed 
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in the same way, each time replacing the noise e of the 
previous iteration by the new noise parameter e'. 

In particular, the probability of successfully generating 
a key-bit in the n-th iteration is, similarly to Eq. (|12fl . 
given by = (4 - e^) (2 + e^) /12, where de- 
notes the noise parameter in the n-th iteration. The con- 

(n) 

ditional probability Psucc of a key-bit being generated in 
the n-th iteration, after failure in the previous n — 1 it- 
erations is then given by 



rsucc 



n 



(19) 



The error probability per key-bit pe"r for the 7i-th itera- 
tion can easily be written as 



p (n) 
/'err 



3 e (n) 
+ 2e(") 



3e 



2" " 



-, -1 



(20) 



which uses Eq. I|18|) . The contribution to I^^b m * ne n ~ 
th iteration is given by I^l B {e) = 2~™ piucc /key (perr), 
and the overall expectation value of the mutual informa- 
tion per qubit pair in the limit of infinitely many itera- 
tions is thus 



rtotal 
AhB 



in) 



(21) 



This quantity serves as our figure of merit for the com- 
parison with the 6-state protocol. One should however 
keep in mind that it is an average over the various key- 
bit sequences of the successive iterations. Each of them 
has different noise properties which must be taken into 
account when the data are processed further by a privacy 
amplification procedure. 

In the noiseless case (e = 0), the Singapore protocol 

yields a mutual information I^ B (0) = | for the first 
iteration. This is as much as one can get in the 6-state 
protocol; but here we can improve the efficiency by con- 
tinuing the key generation with the left-over sequences, 

e.g. /<& B (0) + I^l B (0) = | + = 0.389 up to the sec- 
ond iteration and so on, with the limiting value of 0.4. 
When Alice and Bob share the complete mixture (e = 1) 
we find the expected result of I^sts 

(1) oc log 2 [1] = 0. 
The numerical plots of the total mutual information for 
Alice and Bob when terminating the key generation af- 
ter one, two, five iterations are shown in Fig.^ The 
comparison with the 6-state protocol shows that the mu- 
tual information obtained in the Singapore protocol is 
larger from the third iteration onwards. Alice and Bob 
do not need to perform more than three key-generation 
iterations as the third iteration already comes so close to 
the limiting value that the benefit of further iterations 
will be less then 0.01%. The total gain compared to the 
6-state protocol is AIa&b = 0.066 or 20% in the noise- 
less case and vanishes for e > |, when paub of Eq. lJT)l 



Singapore 3rd, 4th. 5th 
Singapore 2ikI 
fi si ni i ■ 
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FIG. 1: Total mutual information between Alice and Bob 
for the Singapore protocol for the 1st to 5th iteration in 
comparison with the tomographic 6-state protocol. The 
plotted average mutual information of Alice and Bob in 
the 6-state protocol represents the function IaSb ^) = 
| (elog2 e + (2 — e) log2 [2 — e]) . Note, that the total mutual 
information up to the 3rd, 4th and 5th iteration are so close 
that they overlap and the 3rd iteration is already a very good 
approximation of Ia&b ■ The plot covers the range < e < | , 
i.e., the e- values for which paub of Eq. (QQ is not separable. 



is separable. This larger efficiency is expected since the 
Singapore protocol is minimally tomographic and does 
not waste as much information as the 6-state protocol. 

Our first conclusion is, therefore, that the Singapore 
protocol is considerably more efficient than its obvious 
competitor, the tomographic 6-state protocol, and offers 
an alternative way for establishing a secret key between 
the communication partners. We will now discuss pos- 
sible incoherent eavesdropping attacks on the Singapore 
protocol and find the noise thresholds below which the 
security of the protocol is guaranteed. 



D. Constraints on Eve's eavesdropping 

In Sec.fB] Alice and Bob received a two-qubit state 
sent by a provider. We must however assume that this 
provider is not trustworthy and eager to know A&B's 
secret. We hence identify the provider as the most dan- 
gerous eavesdropper (Eve) possible, and give her full con- 
trol over the source. In the worst case scenario, Eve is 
smarter with her technology and can even replace the 
usually noisy channel between Alice and Bob by a perfect 
one. She is then in the position to entangle an additional 
ancilla to each qubit pair she sends, and the disturbances 
she causes by doing so would imitate noise. But Alice 
and Bob perform a complete tomography of the shared 
state and since they agree to use the channel only when 
the noise has the properties reflected in Eq. QJ, they can 
greatly restrict how Eve can entangle ancillas, and later 
on deduce the shared key 

Eve will prepare a 3-party pure state because she has 
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no advantage from creating a mixed state and thus intro- 
ducing classical noise herself. We decompose the state as 



In Ref. [l3| it was shown that, given the constraints of 
Eq. ljT7|) . the most general state Eve can construct, up to 
unitary equivalence, can be written as 



\S f 



(22) 



1=1 



where the (unnormalized) states \Ei) represent Eve's an- 
cilla. The pure states \ll) belong to Alice and Bob and 
form a non-orthogonal basis {\H)}f =1 , where the tetrahe- 
dron states \l) and \l) are defined as 



\l){l\ = \{l + t l -a) 



(l-t r a) 



1 = 1,2,3,4, 



with the phase-conventions 



{l\k) = (k\l) and (l\k) =-(k\l), 



(23) 



(24) 



the second of which implied by the first. Some useful rela- 
tions of these states can be found in the Appendix. Note, 
that the decomposition of Eq. 12 I'll allows for exactly four 
components on Eve's side, together forming Eve's ancilla 
state. Each ancilla can thus be represented by a maxi- 
mally four-dimensional system so that the ancilla can be 
regarded as another qubit pair. 

Eve's ancilla state is however restricted by the condi- 
tion that A&B must receive the two-qubit state paub of 
Eq. which they check by comparing their outcomes 
of the tomographic measurement. Assuming that all the 
noise originates in Eve's eavesdropping attempt, the 3- 
party state \S e ) must be such that 



tr Ev o [|5 £ >(5 e |] = pA&s(e)- 



(25) 



Let us rewrite Paub using the expansion of the identity 
matrix in Eq. i|A5() and the decomposition of the singlet 
in Eq. (|X3|) . to get 



PA&B(e) = I l"X**l fl-|e + 3e<y lfc ). (26) 



l,k=l 



This expression immediately gives the following con- 
straints on Eve's ancilla state 



(E k \Et) = 



2 - 3e 3e 



16 



— -Ski for k, I = 1, . 



(27) 



For e = 0, the \Ei) are identical and Eve cannot ex- 
tract any information. For e = |, the scalar products in 
Eq. H27fl show the orthogonality of the \E{) which implies 
that Paub is separable. Indeed, Alice and Bob share a 
separable Werner state 

PAUB = \ I"><"1 = \ (l - \*A ■ , (28) 

and thus all correlations arc classical. 



IS, 



a|si2)|s 3 4) + /3|S13>|S24> 



(29) 



where the first qubit is held by Alice, the second by Bob 
and the third and fourth by Eve. The amplitudes a 
and j3 must now be chosen so that Eve's ancilla satisfies 
Eq. By using Eq. (JS) and Eq. |gSJ we find Eve's 

states to be 



\E k 



1 



\kk) + hkk) 



(30) 



and evaluating the scalar products (E k \E{) and compar- 
ing with Eq. (EH) we deduce the constraints on the pa- 
rameters a and /3, 



and 



1 



(31) 



Since we have a freedom of global phase for \S e ) we can 
choose j3 to be real, i.e. (3 = ^fi. The only free parameter 
is then the phase (f> in 



a+ 2 



(32) 



Eve wants to guess Alice's key-bit and constructs a 
state for each outcome k Alice could measure re- 
gardless of Bob's result. These conditional ancilla states 
are 



pf = tr A&B [P fe |5 e )(5 e |], 



(33) 



l ±^-\kk)(kk\ 



+ 4 1 



^=\kk}) (a*(s\-^=(kk\ 



where P k is the POVM element for Alice measuring k. 
Note, that all p k E are subnormalizcd to j, the a priori 
probability that Alice will measure a particular k. 

Owing to the symmetry between Alice and Bob, the 
ancilla states conditional to Bob's measurement results 

(k) 

are unitarily equivalent to these p E . Therefore, it does 
not matter whether Eve tries to learn Alice's measure- 
ment results or Bob's. 



E. Incoherent Eavesdropping attacks 

Let us summarize what we have found so far. For each 
qubit pair that Eve sends to A&B she will keep a qubit 
pair (the ancilla) for herself. In the first iteration of the 
key generation scheme Alice and Bob will use the mea- 
surement outcomes of two qubit pairs. Eve has thus two 
corresponding ancillas which she can measure to guess 
A&B's generated key-bit. For the second iteration Eve 
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will have four, for the third she will have eight ancillas 
and so on. 

We suppose Eve has no means of storing her ancillas 
until classical communication between Alice and Bob is 
done. She therefore has to measure them individually as 
she creates them, without being able to include the clas- 
sical information in her measurement. Her measurement 
can be optimized such as to maximize her mutual infor- 
mation with Alice. We will call her optimal strategy for 
doing this an incoherent attack as opposed to a coherent 
(joint) measurement performed on the bunch of ancillas 
correlated through the key generation process. The op- 
timal POVM for the of Eq. (G3J) was found using the 
iterative procedure in Ref. and is analogous to the 
optimal POVM for the 6-state protocol given there. The 
4-mcmbcr POVM consists of the projectors 



Mi 



ei = 



|e/)(e/|, 
1 + V3e~ 



14, 



— e 



(34) 



for I = 1,2,3,4, where 

^4 



is the phase of Eq. H32[) . and 

the Mi obey J2t=i m i = 1 - Note that thc POVM is 
independent of the noise parameter, e. 

Interestingly, in the interval < e < e where e = 
0.1725 (obtained numerically by solving a transcendental 
equation), it was found that a 5-member POVM gives 
a slightly larger mutual information then thc 4-member 
POVM (less than 1% larger). Thc fifth element has the 
following expression 



M 5 = |e 5 )(e 5 | where |e 5 ) = ^ - 4^ ^ \ ei ) (35) 



1=1 



where /i is a function of e and < fj, < 1/2. All the other 
{l e i)}f=i have to be modified in the following manner 



(36) 



to ensure the elements sum up to identity. For the pur- 
pose of finding the noise threshold, we can just use the 
simpler 4-mcmbcr POVM since as we shall see later, the 
noise threshold is always much larger than e for any iter- 
ation. 

With the 4-member POVM, the joint probabilities q k i 
of Alice measuring k and Eve measuring I are given by 
the same expression as Alice and Bob's joint probabili- 
ties in Eq. (|7|) with e replaced by a new noise parameter 
?y, quantifying the noise between Alice and Eve, with 




(37) 



Note that for e = the noise between Alice and Eve 
reaches a maximum (rj = 1) and when e = | there is no 
noise between Alice and Eve (t] = 0). 
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TABLE II: Joint probabilities between Alice and Eve with the 
marginals X = [q 2 s + 3g|) /4 and Y — qd{qd + Qs)/2, for the 
grouping AB = and CD =1. 



We define the probabilities q s (qd) for Alice and Eve 
having the same (a particular different) measurement re- 
sult in analogy to the p s (p d ) in Eq. ljTU|> (Eq. ^TT^i ) by 



q s (r]) = q kk 



and q d {rf) = q k ^i 



n 



12 



(38) 



When a key-bit is generated between Alice and Bob the 
joint probabilities between Alice's and Eve's results are 
as given in Table IITI where we assumed that Bob grouped 
and 



AB 



CD 



Note, 



1 (similarly for other groupings), 
that the probabilities in Table [H] are again more 
anti-correlated than they are correlated since q s < qd 
for all rj. We compute the mutual information between 
Alice and Eve from this table of probabilities. Thc middle 
column does not contribute and the mutual information 
becomes 



(i) 

AUE 
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.FSUCC / 9 , ?\ i 

(<Ts + Qd) log 2 
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4gd lo g2 Wd] +2g s g d log 2 [q s qd\ 



- (<? s 2 + 3^)log 2 

- 2q d (q s + 9d)log2 



Is + Ml 



(39) 



qd(q s + qd) 



where the prefactor is the same as in Eq. I|15|) . This value 
gives the upper bound to the amount of information Eve 
can obtain about the key generated in the first iteration. 
It is valid for incoherent attacks only, by whatever suit- 
able method Eve might employ to extract Alice's key-bit. 

In the n-th iteration Eve will have 2" qubit pairs avail- 
able for measurement. She measures all qubit pairs indi- 
vidually and gets a sequence of 2" letters with A, B, C 
and D occurring ua ,riB,ric and nry = 2™ — ua —riB — nc 
times, respectively. In all announced positions which con- 
tribute in the key generation of a key-bit, Alice always 
has the same letter, say A. The probability of Eve mea- 
suring a sequence which contains ua times A is given by, 
with q s and qd from Eq. JSHJi 



q^{n A ) 



■qs A q 2 d" 



(40) 
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If Bob grouped AB = and CD = 1, say. 



the probability of Eve getting a particular distribution 
{tt-a, n B , nc, no} and Alice having the key-bit is then 



qn(n A ,n Bl ) = q^(n A ) + q®(n B ), 

„ \ "A 
_ 

Qd 



4 



(41) 



and similarly for group 1 . The marginal probabilities for 
Eve getting a distribution {n A , n Bl nc, n B } is then 



q n (nA,n Bl nc,n D ) = q°(nA, n B ) + ?i(no, nu), 

,2™ D / „ \ ™J 



J =J 4 



Id 



(42) 



The number of sequences with a particular distribution 

{n Al n Bl n c ,n D } is 



2"! 5 



(43) 



2" 

>UA,ri B ,nc,nD 
and Alice's marginals <?„ for fc = 0, 1 turn out correctly 



2 n ,nA+n B +nc+n D 

n^! ^c! no\ 



E 

Hi,nB,"C,«D 

1 

2' 



n A ,n B ,nc,n D 



q^(nA,n B ,n c ,n D ) 



(44) 



The contribution to the mutual information that Eve 
shares with Alice from the n-th iteration can now be 
calculated, 



r(») 
l AScE 



(6) 



„(») 

i-'succ V 



1 2" 

E 

fc— riA,nB ,nc ,no=0 

2™ 



X log; 



riA,nB,nc,nD; 

qk(n A ,n B ,n c ,n D ) 



q n {n A ,n Bl n c ,n D ) 



q n (nA,n B ,n c ,n D )q^ 



(45) 



where Psucc is again the probability of success in the n-th 
iteration (Eq. fXHjl ) and the factor of 2~" gives the mu- 
tual information per qubit pair used. The total mutual 
information that Eve can reach if Alice and Bob perform 
infinitely many iterations is then 



rtotal 
l A&cE 



(e) 



E i{ aUz)- 



(46) 



In the noise-free case the mutual information of Eve van- 
ishes I'a^e^) 00 1°S2 [1] = 0. This is clear since the 
channel between Alice and Bob is perfect and the chan- 
nel between Alice and Eve is completely noisy (j] = 1). 



F. Security 

According to the Csiszar-Korner Theorem in Ref . ; 
Alice and Bob are able to share a secret key provided 



SiiiRnpuir 3r<l. I'll- 51 1; 

— Singapore 2nd 

Singapore 1st, 

tj-statc 




0.1 []. 



II.;! u. I 



FIG. 2: Yield for the Singapore protocol for the 1st to 5th it- 
eration in comparison with the tomographic 6-state protocol. 
For the 6-state protocol we used the mutual information be- 
tween Alice and Eve obtained in Ref. IT3l . The yields for the 
3rd, 4th and 5th iteration overlap too, as they did in Fig.0 
and the latter can be regarded as a very close approximation 
to the yield in the limit of infinitely many iterations. 



their mutual information I^lth exceeds the mutual in- 
formations shared between Eve and one of the commu- 
nication partners I a &e an d ^b&e- The CK-yield is then 



CK 



rtotal 
l A&cB 



rtotal 



(47) 



The CK-yield determines the length of the secure key 
Alice and Bob can obtain from the generated raw key 
of length L; namely the length of the secure key will 
maximally be Yqk L (for one-way communication). The 
intersection between Ia&b an< ^ ^a&e thus g ives the final 
noise threshold below which a secret key between Alice 
and Bob can be generated by one-way communication 
that relies on error correction codes. 

In Fig.|21we plot the CK-yield for the 6-state protocol 
and different iterations of the Singapore protocol. Ob- 
serve that the yield of the Singapore protocol is distinctly 
larger than the yield of the tomographic 6-state protocol 
from the second iteration onwards. For e = the gain is 
already 20% and it increases significantly for larger noise 
parameters. Further, the noise threshold for the first it- 
eration of the Singapore protocol is at e = 0.409 and 
increases to e = 0.417 for the 3rd iteration. Additional 
iterations will raise this value in the 4th decimal place, 
so that e = 0.417 can count as the maximum noise Alice 
and Bob can accept when establishing a secure key with 
the Singapore protocol. In contrast, the 6-state proto- 
col has its noise threshold at the much smaller value of 
e = 0.236. Compared to the 6-state protocol the noise 
threshold of the Singapore protocol is remarkable 76.7% 
higher. This result is our key observation in this paper. 
Given a number of qubit pairs, measuring the tetrahe- 
dron POVM and using the above key-generation scheme 
thus leads to a raw key substantially longer than the one 
that could be produced by the 6-state protocol. Addi- 
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tionally, Alice and Bob are still able to share a secret key 
when the noise level exceeds the 6-state threshold by a 
lot. 



G. Discussion and conclusions 

The analysis of the eavesdropping attacks was car- 
ried out for the original protocols, without any error- 
correction or privacy amplification schemes. It is thus 
a comparison between the Singapore protocol and the 6- 
state protocol in their pure form only up to the extraction 
of a raw key. We have seen the inherent potential of both 
protocols and analysed in detail how much mutual infor- 
mation the communication partners Alice and Bob can 
establish between each other when using the Singapore 
protocol. It turns out that A&B can already stop the key 
generation after the third iteration without losing much, 
since the mutual information up to the third iteration 
is already very close to the limiting value of infinitely 
many iterations. The comparison with the 6-state proto- 
col showed that the efficiency of the Singapore protocol 
is up to 20% larger than in the 6-state protocol. 

We continued our discussion by constructing incoher- 
ent eavesdropping attacks under the following assump- 
tions: 1) A source controlled by the eavesdropper Eve 
distributes the singlet state, mixed with unbiased, white 
noise scaled by the noise parameter e. 2) Eve is the cause 
for all noise; and 3) Eve can not store her ancillas and 
is thus not able to incorporate knowledge of the classi- 
cal communication between Alice and Bob when mea- 
suring her ancillas. Additionally she is constrained to 
perform only individual attacks and cannot measure cor- 
related ancillas in a joint measurement. Condition 1) is 
equivalent to the scenario where Alice sends a qubit in 
a state orthogonal to one of the tetrahedron states from 
Eq. J22J), each with probability j. Eve could then inter- 
cept the traveling qubit and produce an optimal clone 
and an anti-clone. Here she also keeps two qubits which 
she can measure and Bob receives a disturbed state. To- 
gether with condition 2) this leads to the worst case sce- 
nario for Alice and Bob, where Eve can realize optimal 
cloning. This is reasonable since we are interested in ab- 
solute security statements which rely only on the laws 
of physics and not on technical abilities of Eve. On the 
other hand, we assumed condition 3) which is clearly a 
relaxation to this strictness. But this is still a valid con- 
straint given that modern technology has not developed 
reliable quantum storage systems and it is not yet feasi- 
ble to perform joint measurements on demand. However, 
we have also analysed coherent eavesdroppingattacks on 
the Singapore protocol as discussed in Ref. j4| and will 
present a detailed and extended report in due time. 

Our discussion did assume throughout that Alice and 
Bob share a state of the form given in Eq. . A natural 
and open question is then how well will the Singapore 
protocol perform if the state differs from the above, e.g. 
if the noise is somehow biased, and how does it then 
compare to the 6-state protocol? Another issue worth 



addressing is the possible use that Eve can make of the in- 
formation gained when Alice and Bob perform a privacy 
amplification or key purification by other means. How- 
ever, under the conditions 1) - 3), the Singapore protocol 
provides an efficient alternative for generating a secret 
key between two communication partners. The measure- 
ment of the tetrahedron POVM is from a practical point 
of view as feasible as the comparable tomographic 6-state 
measurement (see Ref. 0) and the efficiency and secu- 
rity under incoherent attacks is significantly higher. 
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Appendix 

It is expedient to re-express the tetrahedron states of 
Eq. lO in terms of the POVM elements P t of Eq. 101 by 



\l){l\=^Pu 
10(^ = 1-2^. 



1= 1,2,3,4, 



(Al) 



Then the scalar products of the tetrahedron states are 
given by 



|(Z|fc>| 2 = 4tr[ J P iJ P fc ] = \{l + 25 kl ), 
\{l\k)\ 2 =2tr[fl (l-2P k )} = \{2-25 kl ). 



(A2) 



The singlet \s) can be written in terms of the |^) and \l) 

as 

\s) = -^={\ll) - \ll)) for any 1 = 1,2,3,4, (A3) 
v2 



Furthermore, we expand the identity in terms of \ll) and 
the singlet, 



i = -£izr><zzi-2| S )< S | 



(A5) 



1=1 
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